The IT sector became the most targeted industry in 2025, accounting for 29% of recorded cyber incidents. Finance and insurance followed with 17%, while retail and trade stood at 12%. Healthcare and the transport and logistics sector each recorded 8% of attacks.
The study highlights a shift in attacker motivation. Espionage was the primary goal in 40% of cases, followed by hacktivism at 25% and financial gain at 15%. In 20% of incidents, the exact motivation could not be determined. A significant portion of attacks were carried out by APT groups seeking long-term covert presence in infrastructure.
The landscape of cybercrime has evolved, with new activity clusters and more complex attribution. Hacktivism in 2025 shifted from seeking public attention to aiming for maximum damage to Russian organizations. Additionally, attackers increasingly integrated AI-based solutions, including AI-generated scripts and C2 agents adapted via AI.
Detection times varied significantly. The median detection time for all incidents was 17 days, while ransomware attacks were detected faster, at 7 days. However, 45% of all attacks remained undetected for over a month: 15% for one to six months, 5% for six months to a year, and 25% of attackers remained in the infrastructure for over a year.
